EUVD-2026-53924
GHSA-p5w2-mr8m-c9xj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for authenticated-only access; S:C because SSRF inherently affects systems beyond the vulnerable component via server-as-proxy.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to fix this issue. This patch is called f068ab4ad6f0907ac7001b995588c2673f11a755. You should upgrade the affected component.
AnalysisAI
Server-side request forgery in MissionSquad mcp-api up to version 1.11.9 allows authenticated remote attackers to coerce the server into issuing HTTP requests to arbitrary internal or external destinations via unsanitized OAuth Dynamic Client Registration (DCR) endpoint URLs. The vulnerability exists in the registrationEndpoint field of OAuth templates processed by src/services/dcrClients.ts, which was passed directly to fetch() without scheme validation or SSRF filtering. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental E:P flag indicates proof-of-concept evidence exists. A vendor-released patch is available in v1.11.10.
Technical ContextAI
The affected component is MissionSquad's mcp-api (CPE: cpe:2.3:a:missionsquad:mcp-api:*:*:*:*:*:*:*:*), a TypeScript service implementing the Model Context Protocol (MCP) with OAuth 2.0 Dynamic Client Registration support. The root cause is CWE-918 (Server-Side Request Forgery): the registrationEndpoint parameter supplied in an oauthTemplate was consumed by both McpDcrClients.registerNewClient() and MCPService.normalizeExternalOAuthTemplateForPersistence() and forwarded directly to Node.js fetch() without validating the URL scheme, hostname, or IP range. This allowed non-HTTP schemes such as file://, javascript:, data:, ftp://, gopher://, ws://, and wss:// to be passed, as well as loopback and internal network addresses, enabling the server to act as an unintended proxy into its own network environment.
RemediationAI
Upgrade mcp-api to version 1.11.10 (https://github.com/MissionSquad/mcp-api/releases/tag/v1.11.10), which introduces validateExternalMcpUrl() and assertSafeDcrRegistrationEndpoint() to enforce that registrationEndpoint values use only http or https schemes, are well-formed absolute URLs, and do not resolve to loopback or internal addresses before any fetch() call is issued. The patch commit is f068ab4ad6f0907ac7001b995588c2673f11a755 (https://github.com/MissionSquad/mcp-api/commit/f068ab4ad6f0907ac7001b995588c2673f11a755). If immediate upgrade is not feasible, restrict the ability to create or modify OAuth templates to trusted administrator accounts only, reducing the attacker pool from all authenticated users to admins - note this does not eliminate the SSRF surface but substantially raises the privilege bar. Additionally, deploy egress firewall rules on the mcp-api host to block outbound connections to RFC 1918 ranges, loopback, and link-local addresses, preventing SSRF-driven internal network probing; this does not block external SSRF but protects the most sensitive lateral movement paths.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today